Release date:
2026-08-31 12:50:40 UTC
Description:
* SECURITY UPDATE: csv.Sniffer._guess_quote_and_delimiter() probed the
sample with four dialect regexes whose quoted-field body was a lazy
".*?" compiled under re.DOTALL | re.MULTILINE. Because ".*?" is not
anchored to the first undoubled quote, every candidate start position
rescanned the sample to its end, so csv.Sniffer.sniff() on
attacker-supplied CSV - classically a single column of quoted values -
ran in quadratic time and could consume excessive CPU (CWE-1333,
inefficient regular expression complexity).
- debian/patches/CVE-2026-18503.patch: backport of cpython fd78b565
(gh-98820). The quoted-field body is rebuilt as an unrolled loop,
which is unambiguous and therefore does not backtrack. The 3.10
variant is used because the 3.11+ form relies on a possessive
quantifier that re in 3.9 cannot parse.
- CVE-2026-18503
Updated packages:
-
alt-python39_3.9.23-28_amd64.deb
sha:2bf827b2b7fc5c32c0245ceb194f9d83ab6dbb30
-
alt-python39-debug_3.9.23-28_amd64.deb
sha:33b0553b7c35e67f71cae94ce54ed01250d3d7fd
-
alt-python39-devel_3.9.23-28_amd64.deb
sha:1af5758e864798b9d0458b8f4a9385f75f681b71
-
alt-python39-idle_3.9.23-28_amd64.deb
sha:03be9ba37a402bf5d589c5c5a1eedc39ac8b0450
-
alt-python39-libs_3.9.23-28_amd64.deb
sha:759b58304cb54a4b09c3f3dd08eb650a87821d60
-
alt-python39-test_3.9.23-28_amd64.deb
sha:10e2c6c1943464bfe41f6019da108de21a20f005
-
alt-python39-tkinter_3.9.23-28_amd64.deb
sha:f294783a30a6b1ecde1bf5a05bfd018855876e70
Notes:
This page is generated automatically and has not been checked for errors. For clarification or
corrections please contact the
CloudLinux Packaging Team.
